CEH Exam V3 | Certified Ethical Hacker
(CEH) | Q&A with Rationale (CEH Exam) |
EC-Council
1. An ethical hacker is performing a vulnerability assessment on a target network. They
identify a service running on port 445. Which of the following protocols is most likely
associated with this port?
A. SMTP
B. DNS
C. HTTP
D. SMB
Correct Answer: D
Rationale: Port 445 is the standard port for Server Message Block (SMB) over TCP for file
sharing in Windows environments. While port 139 was used for NetBIOS sessions, modern
Windows implementations utilize 445 directly. Identifying this port is crucial for
enumerating shares and potential vulnerabilities like EternalBlue.
2. Which Nmap flag is used to perform a ‘Stealth’ or ‘Half-open’ scan?
A. -sT
B. -sU
C. -sA
,D. -sS
Correct Answer: D
Rationale: The -sS flag initiates a TCP SYN scan, often referred to as a stealth scan because
it does not complete the three-way handshake. By sending a SYN and waiting for a
SYN/ACK, the scanner determines the port status without opening a full connection. This
method helps avoid detection by some legacy logging systems that only record completed
connections.
3. A security professional uses the command ‘nmap -O 192.168.1.1’. What is the primary
objective of this command?
A. Output to a file
B. Operating System detection
C. Open port scanning only
D. Optimized speed scanning
Correct Answer: B
Rationale: The -O flag in Nmap triggers the tool’s OS detection engine by analyzing TCP/IP
stack fingerprinting responses. It examines how the target host reacts to specific probes,
such as TCP options and window sizes. This information is vital for an attacker to tailor
exploits to the specific operating system version running on the target.
, 4. In the context of the Shared Responsibility Model in Cloud Computing, who is responsible
for securing the physical infrastructure?
A. The Internet Service Provider (ISP)
B. The Customer
C. The Cloud Service Provider (CSP)
D. The Regulatory Body
Correct Answer: C
Rationale: In all cloud service models (IaaS, PaaS, SaaS), the Cloud Service Provider is
responsible for the physical security of the data centers. This includes power, cooling, and
physical access controls to the hardware. The customer is generally responsible for
securing the data and applications they place within that infrastructure.
5. Which type of password attack involves comparing the hashes of a list of common
passwords against the stolen hash file?
A. Brute-force attack
B. Rainbow Table attack
C. Birthday attack
D. Dictionary attack
Correct Answer: D
(CEH) | Q&A with Rationale (CEH Exam) |
EC-Council
1. An ethical hacker is performing a vulnerability assessment on a target network. They
identify a service running on port 445. Which of the following protocols is most likely
associated with this port?
A. SMTP
B. DNS
C. HTTP
D. SMB
Correct Answer: D
Rationale: Port 445 is the standard port for Server Message Block (SMB) over TCP for file
sharing in Windows environments. While port 139 was used for NetBIOS sessions, modern
Windows implementations utilize 445 directly. Identifying this port is crucial for
enumerating shares and potential vulnerabilities like EternalBlue.
2. Which Nmap flag is used to perform a ‘Stealth’ or ‘Half-open’ scan?
A. -sT
B. -sU
C. -sA
,D. -sS
Correct Answer: D
Rationale: The -sS flag initiates a TCP SYN scan, often referred to as a stealth scan because
it does not complete the three-way handshake. By sending a SYN and waiting for a
SYN/ACK, the scanner determines the port status without opening a full connection. This
method helps avoid detection by some legacy logging systems that only record completed
connections.
3. A security professional uses the command ‘nmap -O 192.168.1.1’. What is the primary
objective of this command?
A. Output to a file
B. Operating System detection
C. Open port scanning only
D. Optimized speed scanning
Correct Answer: B
Rationale: The -O flag in Nmap triggers the tool’s OS detection engine by analyzing TCP/IP
stack fingerprinting responses. It examines how the target host reacts to specific probes,
such as TCP options and window sizes. This information is vital for an attacker to tailor
exploits to the specific operating system version running on the target.
, 4. In the context of the Shared Responsibility Model in Cloud Computing, who is responsible
for securing the physical infrastructure?
A. The Internet Service Provider (ISP)
B. The Customer
C. The Cloud Service Provider (CSP)
D. The Regulatory Body
Correct Answer: C
Rationale: In all cloud service models (IaaS, PaaS, SaaS), the Cloud Service Provider is
responsible for the physical security of the data centers. This includes power, cooling, and
physical access controls to the hardware. The customer is generally responsible for
securing the data and applications they place within that infrastructure.
5. Which type of password attack involves comparing the hashes of a list of common
passwords against the stolen hash file?
A. Brute-force attack
B. Rainbow Table attack
C. Birthday attack
D. Dictionary attack
Correct Answer: D
